Securing Password Authentication for Web-based Applications

Abstract

There is currently no foolproof mechanism for any website to prevent their users from being directed to fraudulent websites and having their passwords stolen. Phishing attacks continue to plague password-based authentication despite ag-gressive efforts in detection, takedown, user awareness and training programs. In this paper, we apply a threat analysis on the web password login process, and highlight a design shortcoming in the HTML field which we recommend be deprecated. This weakness can be exploited for phishing and man-in-the-middle (MITM) attacks as the web authentication process is not end-to-end secured from each input password field to the web server. We identify four protocol properties and one browser property that encapsulate the requirements to stop web-based password phishing and MITM attacks, and propose a secure protocol to be used with a new input credential field that complies with the properties. We further analyze the proposed protocol through an abuse-case evaluation and perform a test implementation to understand its data and execution overheads.